mirrors/keycloak
1
0
Fork 0
mirror of https://github.com/keycloak/keycloak.git synced 2026-01-25 16:42:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

Do not verify nonce in access and refresh tokens (only id tokens) (#26891)

Browse Source 
Closes #26651

Signed-off-by: Grzegorz Grzybek <gr.grzybek@gmail.com>
This commit is contained in:
Grzegorz Grzybek
2024-02-08 13:19:32 +01:00
committed by GitHub
parent edd68d12fb
commit a95894dbad
1 changed files with 1 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
js/libs/keycloak-js/src/keycloak.js
View File

@@ -802,10 +802,7 @@ function Keycloak (config) {
setToken(accessToken, refreshToken, idToken, timeLocal);
if (useNonce && ((kc.tokenParsed && kc.tokenParsed.nonce != oauth.storedNonce) ||
(kc.refreshTokenParsed && kc.refreshTokenParsed.nonce != oauth.storedNonce) ||
(kc.idTokenParsed && kc.idTokenParsed.nonce != oauth.storedNonce))) {
if (useNonce && (kc.idTokenParsed && kc.idTokenParsed.nonce != oauth.storedNonce)) {
logInfo('[KEYCLOAK] Invalid nonce, clearing token');
kc.clearToken();
promise && promise.setError();